App in app catalog only available in specific sitecollection

Question

I'm creating a provider hosted app for sharepoint which contains a number of client web parts. The app is for a specific department and it needs some custom configuration (columns, contenttypes etc) in the site in order for it to work.

When I deploy the app to the app catalog, it automatically becomes available to all the sitecollections. I don't want users in other sitecollections to be able to install this app. Is there a way to do this without activating the sideloading feature?

EDIT: I'm in an SharePoint online environment so I'm not able to create a separate webapplication for the sitecollection

Answer 1

Alternative 1

Your App Catalog site can be configured at web application, NOT at site collection level. Since an App Catalog is scoped to a web application, all apps that you want to make available have to be in the App Catalog site for that web application, and eventually to all site collections under it.

However, you can have more than one App Catalog site and create a separate App Catalog in another web application and move specific department site collection there.

Assuming you're on on-prem SharePoint environment, the aforementioned configuration could be done

Updated

Alternative 2 With the help of deployment UI and filtering, you can specify which specific site collection you want your app to be installed on, too. This method is effective for both SharePoint-Online and On-Prem

Answer 2

I found out that a user needs read rights on the app catalog to be able to see the app in "Apps from your organization". This also applies to the list item in the app catalog. So I stopped the permission inheritance on the list item for my app in the app catalog, and only gave specific users of my sitecollection read rights on the list item.

I still can't prevent that those users with rights install it in another sitecollection, but at least not every user can install the app in his sitecollectin.

Answer 3

My approach to this problem would be to make use of add-in event receiver.

Implement an AppInstalling event and check before hand where the user is trying to install the add in. If it is one off the target site collection/site then allow the installation or throw a permission denied error.

To read about the add in events please refer this Create an add-in event receiver in SharePoint Add-ins

Answer 4

Site collection app catalogs are a newish feature that would allow you to do this.

Answer 5

No access to app in global App Catalog

My recommended approach for our (enterprise) use case is:

1. Add App to global app catalog
2. Remove all access permissions for all users except SPO-Admins on (app) item level
3. The SPO-Admin then adds (and trusts) the App to the single site collection, where it should be added.

Advantages:

• Nobody can add the app anywhere else
• Nobody can even download the app from app-catalog
• No SiteCollection App Catalog needed
• This works for Add-Ins and for SPFx-Apps

Disadvantages:

• SPO-Admin has to trust the app on site level, so approval by site owner should be retrieved beforehand.

Site Collection scoped app catalog

As previously stated, one option is also to create a Site Collection scoped app catalog.

Advantages:

• Dedicated App Catalog only for the SiteCollection

Disadvantages:

• the catalog has to be created through PowerShell by an SPO-Admin
• It creates an additional place in the tenant, where apps can be added, so another place to care/worry of
• Difficult to protect from users, if site has users as Site Collection Admins
• The classic PHA-Apps are not working properly (they do not show up as 'addable' to the site), if the SPO-Admin who created the SCA-App-Catalog was not also a site collection admin (SCA) during creation of the catalog.

Answer 6

for "Site Collection scoped app catalog", more disadvantages are listed everywhere I searched.

However, my interest is the ability to have a different version of SPFx component in test site collection and different version on production site collection (same tenant). Not sure how this will be possible in tenant level.